1. Technical Field
The present invention relates to computer networks in general and, in particular, to an intrusion detection system that protects such networks from malicious attacks launched by hackers.
2. Prior Art
The worldwide web (WWW) better known as the Internet is fast becoming the premier computer network for communicating both private and public information. The Internet is an open network that can be accessed by anyone using primarily a protocol called TCP/IP (Transmission Control Protocol/Internet Protocol) or other protocols. Because of its openness computers on private networks (intranets) are susceptible to malicious attacks by hackers. Computers have become the main instrument of communication for business and government agencies. For example, many business and government agencies use computers and computer networks to link remote offices, share data and other resources among employees within an office or campus, communicate with customers via electronic mail, reach new customers via electronic mail, provide information via web sites, etc.
Because businesses, governments and individuals rely heavily on computers and the Internet malicious attacks could result in catastrophic economic loss or embarrassment. As a consequence computer security has become a major concern of business, government and individuals using the computer as a major communication vehicle.
There are several ways in which hackers may elect to inflict malicious attacks on computers. One way is to disrupt computers' operation by disseminating programs that take unauthorized control of a computer's operating system. Another way is to discover confidential information about assets in the computer or a subnet in the network for the purpose of deleting data, modifying date and/or copying data. Any of these actions could adversely affect a home, business, or governmental agency network.
To carry out these attacks a hacker or attacker may wish to obtain information by corrupting a normal Transmission Control Protocol (TCP) session-opening handshake. In this regard, the attacker may initiate a TCP session by sending a Synchronize (SYN) packet from User Space (that is, User as opposed to Kernel mode in the Operating System). The resulting SYN packet is not different from legitimate traffic; so it will pass firewalls and be accepted by the victim or scanned host, if the TCP Destination Port is open (that is, the host is programmed to reply to TCP SYN packets arriving with the given port number). Therefore, open ports on the scanned host will reply with a TCP packet with both the SYN and Acknowledgment (ACK) bits in the TCP header set (equal to 1 as opposed to 0). This reply is called a SYN/ACK. A port that is not programmed to respond is called closed, and typically the host will respond with a TCP packet in which the Reset (RST) bit has been set. Upon receiving a RST response, the attacker will typically record (possibly with automatic software freely available on the Internet) the fact that a given TCP port at a given Internet Protocol (IP) Destination Address is closed, or simply do nothing. However, if there is a SYN/ACK response from the victim, the attacker will know that he has found an open port that may be susceptible later to an actual attack. To try to avoid detection by some logging tools and suspicion by the victim host, the attacker might immediately responds with a RST packet. Another reason to respond with a RST quickly is to ensure that the victim's computer does not crash due to an excessive number of half-open connections. In doing so the attacker does no damage to the scanned computer and can continue to scan, thereby fulfilling the goals of attacker reconnaissance. At the same time, the goals of the subnet administrator include avoiding release of information about open ports and applications running in the subnet.
The prior art has recognized the importance of computer networks and has provided intrusion detection systems to protect them from hackers. Examples of prior art intrusion detection systems can be found in U.S. Pat. Nos. 6,477,651; 6,363,489; 6,405,318; 6,275,942; 5,991,881 and 6,282,546. Even though the respective intrusion detection systems described in each of the patents works well for its intended purpose, for the most part most require the insertion of a marker into the network traffic in order to detect surreptitious activities, such as scanning, or reconnaissance in the network. In several situations it may be difficult to use the marker. Therefore, an alternate technique to detect scanning reconnaissance is desirable.